How do I map the device details such as \Device\Harddisk1\DR1 in the event log to a drive letter such as C:?

Question

Using the event viewer, I can see that the event log has entries such as "The driver detected a controller error on \Device\Harddisk1\DR1." and "The driver detected a controller error on \Device\Harddisk1\DR7.".

Using VC++ code, I want to translate this device path (e.g. \Device\Harddisk1\DR1) to a drive letter such as C: wherever applicable (I understand that not all the devices will map to a drive letter).

Using FindFirstVolume and FindNextVolume I am able to loop through all the volumes and for each, I am using QueryDosDevice to get the device name and GetVolumePathNamesForVolumeName to get the drive letter.

The problem I am having is that when I use the above method to get the device names, I end up with device names such as "\Device\HarddiskVolume3", "\Device\HarddiskVolume2", etc. I do get these mapped to the drive letters. However, I am not sure how these map to the device name format I see in the event log entry.

So, in summary, my question is: How do I map the device name format "\Device\HarddiskVolume%d" to the format "\Device\Harddisk%d\DR%d" where each %d is a number.

Answer 1

This isn't C++ code, but two applications written in C++ show this information, at least to check your results. I don't believe the source of either application is readily available.

1. NirSoft's DriveLetterView matches drive letter to \Device\HarddiskVolume%d in the Drive Letter and Device Path columns.

2. SysInternals' WinObj matches drive letter to \Device\HarddiskVolume%d and \Device\Harddisk%d\DR%d to PhysicalDrive%d.